Nginx服务器反向代理MinIO配置

以下文档为您在 Linux 环境中配置 NGINX 以代理请求到 MinIO 提供了基本指导。本文档并不旨在提供 NGINX、代理或反向代理的全面方法。根据您的基础设施需要修改配置。

本文档假设以下内容：

一个现有的 NGINX 部署
一个现有的 MinIO 部署
一个唯一标识 MinIO 部署的 DNS 主机名

有两种模型用于将请求代理到 MinIO 服务器 API 和 MinIO 控制台：

Dedicated DNS

为 MinIO 服务创建或配置一个专用的 DNS 名称。

对于 MinIO 服务器 S3 API，将请求代理到该域名的根目录。对于 MinIO 控制台的 Web GUI，将请求代理到 /minio 子路径。

例如，给定主机名 minio.example.net :

将请求代理到 https://minio.example.net 的根目录到监听在 https://minio.local:9000 的 MinIO 服务器。
将请求代理到 https://minio.example.net/minio/ui 子路径到监听在 https://minio.local:9001 的 MinIO 控制台。

以下位置块为您在独特环境中进行进一步自定义提供了模板：

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass https://minio_s3; # This uses the upstream directive definition to load balance
   }

   location /minio/ui/ {
      rewrite ^/minio/ui/(.*) /$1 break;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websockets in MinIO versions released after January 2023
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      # Some environments may encounter CORS errors (Kubernetes + Nginx Ingress)
      # Uncomment the following line to set the Origin request to an empty string
      # proxy_set_header Origin '';

      chunked_transfer_encoding off;

      proxy_pass https://minio_console; # This uses the upstream directive definition to load balance
   }
}

S3 API签名计算算法不支持通过代理方案来托管MinIO服务器API的情况，例如 example.net/s3/ 。

您还必须为MinIO部署设置以下环境变量：

将 MINIO_BROWSER_REDIRECT_URL 设置为 MinIO 控制台的代理主机 FQDN ( https://example.net/minio/ui )

Subdomain

为MinIO服务器S3 API和MinIO控制台Web GUI创建或配置单独的、唯一的子域名。

例如，给定根域 example.net :

将代理请求转发到子域 minio.example.net ，该子域指向在 https://minio.local:9000 上监听的MinIO服务器。
将请求代理到子域 console.example.net ，该子域指向在 https://minio.local:9001 上监听的MinIO控制台。

以下位置块为您提供了一个模板，以便在您的独特环境中进行进一步的自定义：

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass http://minio_s3; # This uses the upstream directive definition to load balance
   }
}

server {

   listen       80;
   listen  [::]:80;
   server_name  console.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websocket
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      chunked_transfer_encoding off;

      proxy_pass http://minio_console/; # This uses the upstream directive definition to load balance
   }
}

S3 API签名计算算法不支持通过在子路径上托管MinIO服务器API的方式，例如 minio.example.net/s3/ 。

您还必须为 MinIO 部署设置以下环境变量：

将 MINIO_BROWSER_REDIRECT_URL 设置为 MinIO 控制台的代理主机 FQDN（ https://console.example.net/ ）

商业支持购买咨询